T16176 integrate whackread into pluto

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "lib/libwhack/qcbor"]
+	path = lib/libwhack/qcbor
+	url = https://github.com/AnimaGUS-minerva/QCBOR.git

.travis.yml

@@ -17,6 +17,7 @@ addons:
       - make
       - flex
       - bison
+      - git
       - python-minimal
       - libgmp-dev
       - libpcap0.8-dev
@@ -52,18 +53,20 @@ before_script:
   - tests/utils/testsetup.sh
   - "PATH=$HOME/stuff/sbin:$PATH export PATH"
   - which tcpdump
+  - gem install cbor-diag
 
 install:
   - if [ "$TRAVIS_OS_NAME" = osx ]; then brew install libpcap libgmp flex bison; fi
   - "PATH=$HOME/stuff/sbin:/usr/lib/ccache:$PATH export PATH"
   - "echo WERROR=-Werror >Makefile.inc.local"
   - "echo ARCH=${BUILD_ARCH}   >>Makefile.inc.local"
   - if [ "$BUILD_ARCH" = i386 ]; then echo "USERLINKEXTRA=-m32" >>Makefile.inc.local; echo "USERCOMPILEEXTRA=-m32" >>Makefile.inc.local; fi
+  - mkdir -p $HOME/stuff/sbin
+  - cp tests/utils/cborseq2pretty.rb $HOME/stuff/sbin
 
 script:
   - export PATH=$PATH:$HOME/stuff/bin
   - "cat Makefile.inc.local"
   - "make env | sort -f"
-  - git --version
   - ./tests/utils/$TEST_JOB
 

include/pluto/ike_alg.h

@@ -10,8 +10,8 @@ struct ike_alg {
     const char *name;
     const char *officname;
     enum ikev2_trans_type algo_type;
-    u_int16_t                  ikev1_algo_id;  /* IKEv1 number */
-    enum ikev2_trans_type_encr algo_v2id;
+    u_int16_t ikev1_algo_id;  /* IKEv1 number */
+    unsigned algo_v2id;
     struct ike_alg *algo_next;
 };
 
@@ -115,7 +115,7 @@ int ike_alg_register_enc(struct ike_encr_desc *e);
 int ike_alg_register_integ(struct ike_integ_desc *a);
 int ike_alg_register_prf(struct ike_prf_desc *a);
 struct ike_alg *ike_alg_ikev2_find(enum ikev2_trans_type algo_type
-				   , enum ikev2_trans_type_encr algo_v2id
+				   , unsigned algo_v2id
 				   , unsigned keysize);
 
 static __inline__ struct ike_encr_desc *ike_alg_get_encr(int alg)

include/pluto/whackfile.h

@@ -1,3 +1,3 @@
 extern void close_whackrecordfile(void);
 extern bool openwhackrecordfile(char *file);
-extern bool writewhackrecord(char *buf, int buflen);
+extern bool writewhackrecord(unsigned char *buf, int buflen);

include/whack.h

@@ -101,6 +101,105 @@ enum whack_opt_set {
     WHACK_STOPWHACKRECORD=3,  /* turn off recording to file */
 };
 
+enum whack_CBOR_actions {
+    WHACK_STATUS =  1,
+    WHACK_SHUTDOWN =2,
+    WHACK_OPTIONS  =3,
+    WHACK_CONNECTION=4,
+    WHACK_ROUTE    =5,
+    WHACK_UNROUTE  =6,
+    WHACK_INITIATE =7,
+    WHACK_INITIATE_OPPO=8,
+    WHACK_TERMINATE=9,
+    WHACK_ADD_KEY  =10,
+    WHACK_NOOP     =23,
+};
+
+#define CborSignatureTag 55799
+#define CborOpenSwanTag  0x4f50534e
+#define CborIPv4Tag      260            /* squatted */
+#define CborIPv6Tag      261
+
+/* values < 24 get encoded in one byte, < 256 in two bytes */
+enum whack_cbor_attributes {
+      WHACK_OPT_NAME = 1,
+      WHACK_OPT_DEBUGGING = 2,
+      WHACK_OPT_ASYNC = 128,
+      WHACK_OPT_SET   = 129,
+      WHACK_OPT_RECORDFILE=130,
+      WHACK_OPT_MYID  = 131,
+      WHACK_OPT_DELETE= 27,
+      WHACK_OPT_CRASHPEER=132,
+      WHACK_OPT_LISTEN   =133,
+      WHACK_OPT_UNLISTEN =134,
+      WHACK_OPT_REREAD   =135,
+      WHACK_OPT_LIST     =136,
+      WHACK_OPT_PURGE_OCSP=137,
+      WHACK_OPT_IKE      = 139,
+      WHACK_OPT_ESP      = 140,
+      WHACK_OPT_CONNALIAS= 141,
+      WHACK_OPT_POLICYLABEL=142,
+      WHACK_OPT_OPPO_MY_CLIENT = 143,
+      WHACK_OPT_OPPO_PEER_CLIENT=144,
+      WHACK_OPT_DELETESTATE=145,
+
+      WHACK_OPT_LEFT     = 3,
+      WHACK_OPT_RIGHT    = 4,
+
+      WHACK_OPT_LIFETIME_IKE = 146,
+      WHACK_OPT_LIFETIME_IPSEC=147,
+      WHACK_OPT_LIFETIME_REKEY_MARGIN=148,
+      WHACK_OPT_LIFETIME_REKEY_FUZZ=149,
+      WHACK_OPT_LIFETIME_REKEY_TRIES=150,
+      WHACK_OPT_POLICY        = 151,
+      WHACK_OPT_KEYVAL        = 15,
+      WHACK_OPT_KEYID         = 16,
+      WHACK_OPT_KEYALG        = 17,
+      WHACK_OPT_END_ADDR_FAMILY=18,
+};
+
+enum whack_cbor_end_attr {
+      WHACK_OPT_END_ID   = 5,
+      WHACK_OPT_END_CERT = 6,
+      WHACK_OPT_END_CA   = 7,
+      WHACK_OPT_END_GROUPS =8,
+      WHACK_OPT_END_VIRT = 9,
+      WHACK_OPT_END_XAUTH_NAME =137,       /* uncommon */
+      WHACK_OPT_END_HOST_ADDRNAME = 10,
+      WHACK_OPT_END_HOST_ADDR     = 11,
+      WHACK_OPT_END_HOST_NEXTHOP  = 12,
+      WHACK_OPT_END_HOST_SRCIP    = 13,
+      WHACK_OPT_END_CLIENT        = 14,
+
+      WHACK_OPT_HOST_TYPE = 15,
+      WHACK_OPT_KEYTYPE   = 16,
+      WHACK_OPT_HAS_CLIENT= 17,
+      WHACK_OPT_HAS_CLIENT_WILDCARD=18,
+      WHACK_OPT_HAS_PORT_WILDCARD=19,
+      WHACK_OPT_HOST_PORT=20,
+      WHACK_OPT_PORT=138,
+      WHACK_OPT_XAUTH_SERVER=139,
+      WHACK_OPT_XAUTH_CLIENT=140,
+      WHACK_OPT_MODECFG_SERVER=141,
+      WHACK_OPT_MODECFG_CLIENT=142,
+      WHACK_OPT_CERTPOLICY=143,
+      WHACK_OPT_CERTTYPE=144,
+      WHACK_OPT_TUNDEV=145
+};
+
+
+
+/* this is the historic message from Openswan < 3.1 */
+struct legacy_whack_message {
+    u_int32_t magic;
+
+    /* for WHACK_STATUS: */
+    bool whack_status;
+
+    /* for WHACK_SHUTDOWN */
+    bool whack_shutdown;
+};
+
 /* whack message should be size independant, but it is in host-endian format */
 struct whack_message {
     u_int32_t magic;
@@ -250,43 +349,7 @@ struct whack_message {
 
     /* for use with general option adjustments */
     enum whack_opt_set opt_set;
-    char *string1;
-    char *string2;
-    char *string3;
-
-    /* space for strings (hope there is enough room):
-     * Note that pointers don't travel on wire.
-     *  1 connection name [name_len]
-     *  2 left's name [left.host.name.len]
-     *  3 left's cert
-     *  4 left's ca
-     *  5 left's groups
-     *  6 left's updown
-     *  7 left's virt
-     *  8 right's name [left.host.name.len]
-     *  9 right's cert
-     * 10 right's ca
-     * 11 right's groups
-     * 12 right's updown
-     * 13 right's virt
-     * 14 keyid
-     * 15 myid
-     * 16 ike
-     * 17 esp
-     * 18 tpmeval
-     * 19 left.xauth_name
-     * 20 right.xauth_name
-     * 21 connalias
-     * 22 left.host_addr_name
-     * 23 right.host_addr_name
-     * 24 genstring1  - used with opt_set
-     * 25 genstring2
-     * 26 genstring3
-     * 27 genstring4
-     * plus keyval (limit: 8K bits + overhead), a chunk.
-     */
-    u_int32_t str_size;
-    unsigned char string[4096];
+    char *string1;               /* for whackrecord file */
 };
 
 /* options of whack --list*** command */
@@ -320,19 +383,16 @@ struct whack_message {
 #define REREAD_ALL	LRANGES(REREAD_SECRETS, REREAD_CRLS)  /* all reread options */
 #define REREAD_TPMEVAL    0x40  /* evaluate in Tcl */
 
-
-struct whackpacker {
-    struct whack_message *msg;
-    unsigned char        *str_roof;
-    unsigned char        *str_next;
-    int                   n;
-    int                   cnt;
-};
+struct whackpacker;
 
 extern err_t pack_whack_msg(struct whackpacker *wp);
 extern err_t unpack_whack_msg (struct whackpacker *wp);
 extern void clear_end(struct whack_end *e);
 
+extern err_t whack_cbor_encode_msg(struct whack_message *wm, unsigned char *buf, size_t *buf_len);
+extern err_t whack_cbor_decode_msg(struct whack_message *wm, unsigned char *buf, size_t *buf_len);
+extern void  whack_free_msg(struct whack_message *wm);
+
 extern size_t whack_get_secret(char *buf, size_t bufsize);
 extern int whack_get_value(char *buf, size_t bufsize);
 

lib/libcrypto/liboswcrypto/xfrm_plugin.c

@@ -282,7 +282,7 @@ ike_alg_ikev1_find(enum ikev2_trans_type algo_type
  */
 struct ike_alg *
 ike_alg_ikev2_find(enum ikev2_trans_type algo_type
-		   , enum ikev2_trans_type_encr algo_v2id
+		   , unsigned algo_v2id
 		   , unsigned keysize __attribute__((unused)))
 {
 	struct ike_alg *e=ike_alg_base[algo_type];

lib/libipsecconf/interfaces.c

@@ -38,16 +38,16 @@
 
 char *starter_find_physical_iface(int sock, char *iface)
 {
-	static char _if[IFNAMSIZ+1];
+	static char _if[IFNAMSIZ];
 	char *b;
 	struct ifreq req;
 	FILE *f;
 	char line[256];
 
-	strncpy(req.ifr_name, iface, IFNAMSIZ);
+	strncpy(req.ifr_name, iface, IFNAMSIZ-1);
 	if (ioctl(sock, SIOCGIFFLAGS, &req)==0) {
 		if (req.ifr_flags & IFF_UP) {
-			strncpy(_if, iface, IFNAMSIZ);
+			strncpy(_if, iface, IFNAMSIZ-1);
 			return _if;
 		}
 	}
@@ -68,19 +68,19 @@ char *starter_find_physical_iface(int sock, char *iface)
 					if ((strncmp(line,"IP_PHYS=\"", 9)==0) &&
 						(line[strlen(line)-2]=='"') &&
 						(line[strlen(line)-1]=='\n')) {
-						strncpy(_if, line+9, MIN(strlen(line)-11,IFNAMSIZ));
+						strncpy(_if, line+9, MIN(strlen(line)-11,IFNAMSIZ-1));
 						break;
 					}
 					else if ((strncmp(line,"IP_PHYS=", 8)==0) &&
 						(line[8]!='"') &&
 						(line[strlen(line)-1]=='\n')) {
-						strncpy(_if, line+8, MIN(strlen(line)-9,IFNAMSIZ));
+						strncpy(_if, line+8, MIN(strlen(line)-9,IFNAMSIZ-1));
 						break;
 					}
 				}
 				fclose(f);
 				if (*_if) {
-					strncpy(req.ifr_name, _if, IFNAMSIZ);
+					strcpy(req.ifr_name, _if);
 					if (ioctl(sock, SIOCGIFFLAGS, &req)==0) {
 						if (req.ifr_flags & IFF_UP) {
 							return _if;
@@ -108,7 +108,7 @@ int starter_iface_find(char *iface, int af, ip_address *dst, ip_address *nh)
 	phys = starter_find_physical_iface(sock, iface);
 	if (!phys) goto failed;
 
-	strncpy(req.ifr_name, phys, IFNAMSIZ);
+	strncpy(req.ifr_name, phys, IFNAMSIZ-1);
 	if (ioctl(sock, SIOCGIFFLAGS, &req)!=0) goto failed;
 	if (!(req.ifr_flags & IFF_UP)) goto failed;
 

lib/libipsecconf/starterwhack.c

@@ -181,33 +181,6 @@ int starter_whack_read_reply(int sock,
 	return ret;
 }
 
-/* returns length of result... XXX unit test would be good here */
-int serialize_whack_msg(struct whack_message *msg)
-{
-	struct whackpacker wp;
-	ssize_t len;
-	err_t ugh;
-
-	/**
-	 * Pack strings
-	 */
-        wp.cnt = 0;
-	wp.msg = msg;
-	wp.str_next = (unsigned char *)msg->string;
-	wp.str_roof = (unsigned char *)&msg->string[sizeof(msg->string)];
-
-	ugh = pack_whack_msg(&wp);
-
-	if(ugh)
-	{
-	    starter_log(LOG_LEVEL_ERR, "send_wack_msg(): can't pack strings: %s", ugh);
-	    return -1;
-	}
-
-	len = wp.str_next - (unsigned char *)msg;
-        return len;
-}
-
 static int send_whack_msg(struct starter_config *cfg, struct whack_message *msg)
 {
   if(cfg->send_whack_msg) {
@@ -223,14 +196,19 @@ static int send_whack_msg_to_socket(struct starter_config *cfg, struct whack_mes
 	struct sockaddr_un ctl_addr =
 	    { .sun_family = AF_UNIX };
 	int sock;
-	ssize_t len;
+	size_t len;
+        unsigned char sendbuf[4096];
 	int ret;
 
 	/* copy socket location */
-	strncpy(ctl_addr.sun_path, cfg->ctlbase, sizeof(ctl_addr.sun_path));
+	strncpy(ctl_addr.sun_path, cfg->ctlbase, sizeof(ctl_addr.sun_path)-1);
 
-        len = serialize_whack_msg(msg);
-        if(len == -1) return -1;   /* already logged error */
+        len = sizeof(sendbuf);
+        err_t ugh = whack_cbor_encode_msg(msg, sendbuf, &len);
+        if(ugh) {
+          starter_log(LOG_LEVEL_ERR, "error encoding: %s", ugh);
+          return -1;
+        }
 
 	/**
 	 * Connect to pluto ctl
@@ -251,7 +229,7 @@ static int send_whack_msg_to_socket(struct starter_config *cfg, struct whack_mes
 	/**
 	 * Send message
 	 */
-	if (write(sock, msg, len) != len) {
+	if (write(sock, sendbuf, len) != len) {
 		starter_log(LOG_LEVEL_ERR, "write(pluto_ctl) failed: %s",
 			strerror(errno));
 		close(sock);